California's New Privacy Statute: Is It A US GDPR?

On September 23, 2018, the governor of California signed into law an amended version of the California Consumer Privacy Act of 2018 (CCPA),¹ which was originally enacted in late June 2018. The amendments are a partial response to extensive criticism of the legislation as overbroad, ambiguous, and excessively burdensome for organizations doing business in California. Throughout the summer, a coalition of businesses and industry associations (including the California Retailers Association, the Consumer Technology Association, the Internet Association and others), engaged in a concerted effort to persuade the California Legislature to clarify certain definitions in the law, limit its scope to prevent unintended consequences and delay its enforcement date to give regulated businesses the requisite time to establish systems and policies for compliance.² The Legislature's response addresses a few, but by no means all, of the industry's concerns. It delays enforcement of most